Hi, @mrmarkuz
I will try to tell you what I encountered during the configuration of NethSecurity. This is a personal opinion and I do not obligate anyone, I just share experience and knowledge
In fact, the project won me over by the fact that they have united in one finished product: OpenVPN, Snort, Netdata and others. Quite functional and clean, and last but not least, beautiful.
But, what impressed me personally is the general Ha + control panel. If I manage to configure everything else, I will test this too. Currently I use keepalived + contractd, but… every change on one router, I have to do manually on the other router.
Thanks for the suggestion for rc.local. It works.
I will make some suggestions for people who read the topic.
The ifconfig command (useful and my favorite :)) is already outdated for most distributions and it is not known when it will be removed from OpenWRT and accordingly it may disappear here:
What I did, I added is:
ip link set dev eth2 down
ip link set dev eth2 address AA:BB:CC:DD:EE:FF
ip link set dev eth2 up
Although the change is not visible on the Web, it works. The router from which NethSecurity provides internet reported that there is a new MAC address and provided a new IP address.
Thanks for the reminder about /etc/opkg/customfeeds.conf, it saved me time downloading each and every packer. Also thanks for the important clarification that later I have to comment on the repo.
At the beginning I mentioned that one of the routers has two interfaces. It has a bond and a vlan on top. Configuration-wise it works.
I have ordered a new micro server. I will only use Proxmox and the main router on top. If you are interested, I can see if it will work in a real situation.
While studying NethSecurity, on my current router I saw that I have an overflow of nf_conntrack_max, the default value is 65536.
In many places on the Internet, when the error ‘nf_conntrack: table full, dropping packets’ appears, they say to change net.netfilter.nf_conntrack_max.
But with the change of net.netfilter.nf_conntrack_max, net.netfilter.nf_conntrack_buckets must also be changed.
As net.netfilter.nf_conntrack_buckets is obtained by dividing net.netfilter.nf_conntrack_max by 2 or 4 or 8.
The tricky part is choosing how many to divide, the larger the divisor, the more RAM and CPU are needed.
In the case of NethSecurity, I have set in /etc/sysctl.d/11-nf-conntrack.conf - net.netfilter.nf_conntrack_max=2097152.
I have chosen 8 and accordingly net.netfilter.nf_conntrack_buckets=262144.
The allocated resource for NethSecurity is 4 cores and 8GB RAM.
And one clarification (if memory serves me correctly) /sys/module/nf_conntrack/parameters/hashsize is responsible for net.netfilter.nf_conntrack_buckets.
net.netfilter.nf_conntrack_max=65536, is a value inherited from many years and perhaps, by default, it would be good to have at least two.
Another interesting case that I encountered is related to the following situation. As I mentioned, I have 2 providers and for each provider I have a Ripe sample for the quality of the internet.
In a MultiWan configuration, for each sample I need to create a Policy for each provider ISP-A and ISP-B. But in the menu there are only Balance, Backup and Custom (3+ Gateways).
And this (3+ Gateways) confused me at first because it is a bit misleading, and in reality I can create a Policy with only one GW. It would be nice to add either in the tooltip or in the documentation that it can be done with only one GW.
Another point where I showed a little creativity is Rules. When adding a new entry, it turned out that the Hostname field is only 12 characters.
But manually correcting the config via console and observing the syntax solved the problem. I hope that in the future there will be no problem with this 
Another thing that at one point bothered me. When entering keys, a field appears that requires a password. It would be useful to specify that this is the password for the account you log in to the web.
After all, SSH keys also have passwords and it took me a while to remember that I need to enter the password for the user for web access. But the idea is good.
- I also have a question, is there a way to activate sftp on dropbear or will I have to replace dropbear with sshd?
Certificates - here I had an interesting case. I use a wildcard certificate issued by letsencrypt, but it is only active for 3 months, after which it must be reissued and copied to all my servers again.
Until now, I have an old machine that takes care of this. As far as I read the documentation, I didn’t understand if there was a way to upload the certificate via console, so I did the following.
- I uploaded an older version of the certificate via web (Certificate+Private key+Chain file), the system reported that it was invalid.
- I copied only Certificate + Private key to the /etc/nginx/custom_certs/ directory via console. And I now have an active certificate.
It is important that the names of the new files are the same as the old ones.
I think that after each copy, nginx must be restarted to load the new certificates.
I have another question:
Subscription - Under the download link, there is a field for entering an email address. I tried with email, but nothing showed up. Can I use NethSecurity without Subscription?
It turned out to be a bit long as a text to read, for which I apologize (professional distortion from work to explain in detail )
